AI-powered phishing attacks surge globally
Kaspersky reported over 142 million clicks on phishing links in Q2 2025, with attackers increasingly using AI tools including large language models, chatbots, and deepfakes to conduct sophisticated phishing campaigns. The attacks target individuals and businesses, attempting to steal biometric data, digital signatures, and financial information through impersonation and fraud schemes.
What happened
Kaspersky reported over 142 million clicks on phishing links globally during the second quarter of 2025. Attackers employ AI-powered techniques including large language models to craft convincing emails, text messages, and websites that mimic legitimate sources without the grammatical errors that previously signaled fraud.
AI-powered chatbots on social media and messaging applications impersonate real users and engage victims in lengthy conversations to build trust, often used for romance scams or investment fraud featuring AI-generated voice messages or deepfake videos. Attackers create convincing voice recordings and deepfake videos of trusted figures such as bank employees, celebrities, or colleagues to promote false prizes or extract sensitive data, with automated calls using AI-generated voices mimicking bank security personnel to trick users into sharing two-factor authentication codes.
Reported impact
Individuals and companies face unprecedented risks from phishing attacks. Attackers target biometric data, digital signatures, and handwritten signatures, and seek to access victim accounts or execute fraudulent financial transactions.
Index analysis
Attackers use AI tools to analyze public data from social media and company websites to launch targeted attacks such as human resources-themed emails or fake calls with personal details. Fraudsters employ advanced trust-building techniques, exploiting legitimate services such as Telegram's Telegraph platform to publish phishing content, and integrate CAPTCHA verification systems into phishing sites before directing users to malicious content, misleading anti-phishing algorithms since CAPTCHA presence is associated with legitimate platforms.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.